A network security monitoring method

Abstract

The application discloses a network security monitoring method and relates to the technical field of network monitoring. The method comprises the following steps: acquiring a target monitoring efficiency, a measured monitoring efficiency and a resource disturbance record; forming an efficiency deviation vector according to a target value and a measured value; determining a sensitivity and constructing a resource response matrix according to a resource change amount and a corresponding efficiency change amount; mapping the efficiency deviation into a resource adjustment vector by using the resource response matrix; and updating resource configuration according to the resource adjustment vector. Since the corresponding relationship between the resource change and the efficiency change is introduced in the resource adjustment process, the monitoring method can distribute different efficiency deviations to corresponding resource dimensions according to the actual influence degree of each resource, thereby reducing the mismatch between the resource adjustment direction and the monitoring demand.

Description

Technical Field

[0001] This invention relates to the field of network monitoring technology, and more specifically to a network security monitoring method. Background Technology

[0002] Network security monitoring typically involves using probes to collect traffic, connectivity data, and device operational information. Resources such as probe density, traffic mirroring range, and feature calculation frequency are configured based on the monitoring target. Different resources have varying degrees of impact on performance metrics such as coverage and response latency, and these impacts change with network load.

[0003] When the monitoring scope or business traffic changes, directly adjusting resources based solely on the deviation between target performance and measured performance makes it difficult to determine the actual impact of resource changes on different performance indicators, easily leading to a mismatch between resource adjustments and performance deviations. Therefore, it is necessary to establish the relationship between resource changes and changes in monitored performance, and determine subsequent resource allocation accordingly. Summary of the Invention

[0004] This invention aims to solve the technical problems in the prior art, such as rigid rule scheduling, lack of multi-dimensional efficiency closed-loop feedback, insufficient time-series feature tracking ability, and lack of dynamic self-evolution capability of the rule base.

[0005] To achieve the above objectives, the specific technical solution of this invention is as follows:

[0006] A network security monitoring method, the method comprising:

[0007] Acquire the target monitoring effectiveness, measured monitoring effectiveness, and resource disturbance records of various adjustable monitoring resources for the current monitoring period;

[0008] An effectiveness deviation vector is generated based on the target monitoring effectiveness and the measured monitoring effectiveness. The sensitivity is determined based on the resource change and corresponding effectiveness change of various adjustable monitoring resources in the resource disturbance record. A resource response matrix is ​​constructed based on the sensitivity.

[0009] The efficiency deviation vector is mapped to the resource adjustment vector using the resource response matrix, where sensitivity is the degree of influence of the corresponding resource change on the corresponding monitoring efficiency dimension;

[0010] After updating the configuration of various adjustable monitoring resources based on the resource adjustment vector, the network security monitoring strategy for the next monitoring cycle is output.

[0011] A further preferred method is to determine sensitivity based on the resource changes and corresponding performance changes of various adjustable monitoring resources in the resource disturbance record, including:

[0012] Keep all resource allocations unchanged except for the target adjustable monitoring resources;

[0013] Apply a preset range of resource changes to the target adjustable monitoring resources;

[0014] Obtain the corresponding changes in monitoring effectiveness;

[0015] Sensitivity is determined based on the ratio of changes in resource volume to changes in monitoring effectiveness.

[0016] In a further preferred embodiment, the resource response matrix update includes: when historical calibration data is missing, a preset initial resource response matrix is ​​used, and during operation, the sensitivity between each resource and each monitoring performance dimension is re-determined based on the resource change and corresponding performance change within the most recent preset monitoring period, and the resource response matrix is ​​updated.

[0017] In a further preferred embodiment, when constructing the resource response matrix, the sensitivity of each type of adjustable monitoring resource is normalized according to the same monitoring effectiveness dimension to obtain the response weight of each resource to the monitoring effectiveness dimension, and the resource response matrix is ​​formed by each response weight.

[0018] A further preferred embodiment, based on the target monitoring effectiveness and the measured monitoring effectiveness, generates an effectiveness deviation vector, including:

[0019] The corresponding performance deviations are determined based on the target coverage and the measured coverage, and the measured response delay and the target response delay, respectively, and each performance deviation is limited to a preset deviation range.

[0020] In a further optimized approach, the efficiency deviation vector is input into the resource response matrix to obtain the initial adjustment amount for each resource dimension. Based on the initial adjustment amount, the resource allocation direction and adjustment magnitude are determined, and a limit is applied when the adjustment magnitude exceeds the upper limit of resource adjustment in a single cycle.

[0021] Further preferred methods include updating the configuration of various adjustable monitoring resources based on resource adjustment vectors, including:

[0022] The current resource configuration is updated proportionally according to the corresponding component of the resource adjustment vector, and the updated resource configuration is restricted to between the corresponding lower and upper limits.

[0023] In a further preferred embodiment, each type of adjustable monitoring resource includes at least the probe density of key nodes, the flow mirror range, and the feature calculation frequency, with each component of the resource adjustment vector corresponding to the configuration adjustment amount of an adjustable monitoring resource.

[0024] In a further preferred embodiment, resource disturbance records are obtained from historical operating data or resource disturbance calibration before going online. When calibrating resource disturbances, a preset proportional change is applied to a single type of adjustable monitoring resource, and the corresponding change in coverage or response delay is recorded.

[0025] In a further preferred embodiment, the target monitoring effectiveness is determined by a multi-dimensional monitoring instruction set, and the measured monitoring effectiveness is determined by the effectiveness indicators collected in the current monitoring cycle. The multi-dimensional monitoring instruction set includes at least coverage instructions and timeliness instructions.

[0026] The beneficial effects of the network security monitoring method provided by this invention are as follows:

[0027] 1. Compared to methods that directly adjust monitoring resources based solely on performance deviations, this application first obtains the target monitoring performance, measured monitoring performance, and resource disturbance records. Then, it forms a performance deviation vector based on the target and measured values. Next, it determines the sensitivity and constructs a resource response matrix based on resource changes and corresponding performance changes. Finally, it uses the resource response matrix to map the performance deviations into resource adjustment vectors, and updates the resource allocation accordingly. Because the resource adjustment process introduces the correspondence between resource changes and performance changes, different performance deviations can be allocated to the corresponding resource dimensions according to the actual impact of each resource, thereby reducing the mismatch between resource adjustment directions and monitoring needs.

[0028] 2. Compared to monitoring methods that maintain a constant resource response relationship over a long period, this application extracts resource changes and corresponding performance changes from continuous monitoring cycles when the resource response matrix lacks calibration data or the monitoring environment changes. It then redetermines the sensitivity of each resource to coverage and response latency, and updates the resource response matrix accordingly. After generating resource adjustment amounts, it also constrains the adjustment results by combining the single-cycle adjustment upper limit and the upper and lower limits of each resource configuration. Therefore, the resource response relationship can be corrected based on operational data, while limiting the magnitude of single-cycle configuration changes. This ensures that the resource adjustment process matches the current monitoring performance relationship when network load changes, and reduces the possibility of configuration fluctuations caused by excessively large adjustments in a single period. Attached Figure Description

[0029] Figure 1 This is a timing diagram of a network security monitoring method provided by the present invention. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings and specific examples. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] like Figure 1 As shown, a network security monitoring method includes:

[0032] To enable direct implementation of the resource-performance adaptive configuration process, at the beginning of each monitoring cycle, the monitoring controller reads the target monitoring performance, the measured monitoring performance, and resource disturbance records. The target monitoring performance includes at least the target coverage C. base and target response delay T base It can be read from a multi-dimensional monitoring instruction set or pre-configured monitoring target parameters; the measured monitoring effectiveness includes at least the measured coverage C of the current monitoring period. cov and average response delay T resp The target values ​​and measured values ​​mentioned above use the same monitoring scope and the same statistical period to avoid performance deviations and distortions caused by different statistical methods.

[0033] Among them, the measured coverage C cov The target monitoring objects can be determined by the ratio of the number of target monitoring objects that generate valid monitoring records within the current monitoring period to the total number of target monitoring objects. Target monitoring objects include key nodes or key links specified in the coverage command; average response time T. resp This is the arithmetic mean of the time differences between the completion of data collection at the sensing node and the formation of the corresponding monitoring analysis results for each monitoring task within the current monitoring period. When a monitoring task generates an alarm, the time when the monitoring analysis results are formed is the alarm generation time; when no alarm is generated, the time when the task completes the analysis and processing is used.

[0034] Furthermore, a valid monitoring record refers to a monitoring record that has completed data collection and analysis within the current monitoring period, has a complete collection timestamp and result generation timestamp, has a valid monitoring object identification, and has not been judged as a duplicate record or a failed collection. If there is no valid monitoring task available for statistical analysis for a certain performance dimension in the current period, then that performance dimension will not participate in the sensitivity update for this period. When generating the performance deviation vector, the most recent valid measured value can be used. If there is no most recent valid value, then the deviation component of that performance dimension will be temporarily set to zero to avoid undefined results due to the calculation of the average value from empty samples.

[0035] The resource disturbance records are used to characterize the relationship between resource allocation and performance response before and after changes in a single type of adjustable monitored resource. Each valid record includes at least the resource category p and the resource allocation r before the disturbance. p,0 Resource allocation after disturbance p,1 The coverage and response latency before and after the disturbance, as well as the monitoring cycle for the disturbance, should be considered. When calibrating before going live, the configuration of non-target resources should remain unchanged, and only the target resources should be changed by 5% to 10% relative to each other. When using historical operating data, only records where other resource configurations have not changed and the network load in the statistical window before and after the disturbance is within the same preset fluctuation range should be selected as valid records. For example, the total traffic change rate can be set as a filtering condition if it does not exceed 10%.

[0036] Furthermore, each resource disturbance record used for sensitivity calculation also stores the target coverage C corresponding to the statistical window to which the disturbance record belongs. base and target response delay T base When the historical monitoring target changes in different periods, Δy C and Δy T The C record was created using this record respectively. base and T base Normalization is performed without substituting the current period's target value back into historical disturbance records. If the historical record does not save the aforementioned target value, it will only be included in sensitivity calculations if it can be confirmed that the target monitoring performance at the time the record was created is consistent with the current target monitoring performance; otherwise, the record will be discarded. This avoids inconsistencies in the normalization benchmarks of different historical records caused by changes in the target value.

[0037] To ensure that the aforementioned probe density, flow mirroring range, and feature calculation frequency can be uniformly incorporated into resource vector and matrix operations, this implementation represents each type of adjustable monitoring resource as a non-negative, single numerical configuration quantity r. p Specifically, the critical node probe density can be expressed as the ratio of the number of enabled probes to the number of deployable critical nodes; the traffic mirroring range can be expressed as the ratio of the number of target links or ports included in the mirroring to the total number of mirrorable targets, or as the proportion of mirrored traffic to the total target traffic; the feature calculation frequency represents the number of feature calculations performed per unit time. For implementations using absolute quantity configurations, the number of probes, the number of mirrored targets, and the calculation frequency can also be used as r respectively. p However, the same resource maintains the same encoding calibrator in disturbance calibration, historical record filtering, and runtime updates. For discrete resources such as link sets and port sets, they are first encoded as scalars according to the above quantity or proportion to participate in sensitivity calculation. After obtaining the update target, the corresponding target is added or removed according to the pre-determined order of business importance or fixed numbering order, and the same mapping rules are used in the calibration phase and the runtime phase.

[0038] Furthermore, to ensure that resource disturbance records reflect the correspondence between changes in target adjustable monitoring resources and changes in monitoring performance, the post-disturbance performance statistics window begins after successful resource configuration issuance and a preset stabilization time. This preset stabilization time can be a monitoring cycle or determined by the configuration activation confirmation signal returned by the sensing / processing node. When using historical operational data to form resource disturbance records, in addition to keeping non-target resource configurations unchanged, it is also required that the same set of monitoring objects and performance statistics criteria be used before and after the disturbance, and records involving network topology switching, concurrent monitoring strategy updates, or network load change rates exceeding a preset threshold are excluded; thereby reducing the interference of non-target factors on the correspondence between resource changes and performance changes.

[0039] To eliminate the influence of different resource dimensions on sensitivity, the change in the p-th type of resource is expressed as a relative change. .in, and These represent the resource allocation of type p before and after the disturbance, respectively. To prevent the aberrant amplification of small positive numbers due to a baseline resource configuration of 0 or too small, the value can be determined based on the minimum effective configuration resolution for that type of resource. For the coverage dimension, the performance variation is defined. For the response latency dimension, in order to improve the performance of uniform representation of positive values, we define: Where C0 and T0 represent the coverage and response delay before the disturbance, respectively, and C1 and T1 represent the coverage and response delay after the disturbance, respectively. When the value is lower than the effective change resolution of the resource configuration, the record is not included in the sensitivity calculation. In this embodiment, 1% can be taken as the effective change resolution.

[0040] The signed sensitivity of resource class p to performance dimension class q is denoted as . .in, Indicates the resource dimension number. , Indicates the coverage dimension. Indicates the response latency dimension; A positive value indicates that increasing this resource is beneficial for improving coverage or reducing response latency. A negative value indicates that increasing the resource will cause the corresponding performance dimension to change in an unfavorable direction. When there are multiple valid disturbance records for the same resource-performance combination within the most recent 20 to 50 monitoring periods, the median of each valid sensitivity can be used as the current sensitivity to reduce the impact of occasional flow fluctuations on the results of a single disturbance.

[0041] The element in the p-th row and q-th column of the resource response matrix is ​​obtained by normalizing the corresponding signed sensitivity, and can be expressed as follows: This ensures that the sum of the absolute values ​​of the columns corresponding to the same performance dimension is 1. The range of values ​​is Here, 'h' is a dummy variable representing the resource dimension used for summation, to avoid confusion with the row number 'p' of the element to be calculated. When the sum of the absolute values ​​of all sensitivities corresponding to a certain performance dimension is less than a preset small amount... When the column has no historical valid weights, the most recent valid response weight is used; when no historical valid weights exist, the pre-stored initial resource response matrix is ​​used. The corresponding column in the matrix; only when the corresponding column of the initial resource response matrix is ​​not configured, the column is set to zero. Can be no greater than Positive numbers are used to avoid division by zero or unfounded amplification of near-zero sensitivity.

[0042] This indicates the resource dimension index to which the matrix element to be calculated belongs. This indicates either coverage dimension or response latency dimension; This represents the total number of dimensions of all adjustable monitoring resources, and is the upper limit of the summation. This represents a dummy variable used for summing across each resource dimension, taking values ​​sequentially. This does not represent an additional resource type, nor does it replace the row number of the element to be calculated. Therefore, the denominator is summed over the absolute values ​​of all resource sensitivities under the same performance dimension.

[0043] The preset initial resource response matrix M0 is used for cold starts when historical calibration data is lacking. Its resource and performance dimensions are consistent with the operational resource response matrix M. M0 can be formed from the calibration results obtained by performing small perturbations on various adjustable monitoring resources before going live. For cases where not all resources have been calibrated, the calibrated matrix columns or elements are written into M0 according to the same signed sensitivity and column normalization rules as during operation, while the uncalibrated parts can be set to zero. After entering the operational phase, only new perturbation records that meet the validity conditions are used to update the corresponding matrix elements or matrix columns, while the remaining parts continue to use M0 or the most recent valid value, so that executable resource response relationships can still be determined even when local historical data is lacking.

[0044] If a certain performance dimension is set to zero because it lacks historical effective weights and the corresponding column of the preset initial resource response matrix M0 is not configured, then that column will not participate in resource adjustment during the current monitoring period. When the deviation component of that performance dimension is non-zero, the monitoring controller, under the condition that the upper and lower limits of resource configuration are allowed and basic monitoring functions are not affected, can select a type of adjustable monitoring resource to apply a small perturbation no less than the minimum effective configuration resolution, and after the configuration stabilizes, collect the corresponding performance change to form at least one effective sensitivity record before updating the matrix column. Thus, when the resource response relationship for that performance dimension is completely lacking, no unfounded resource adjustment will be generated with a matrix column of all zeros.

[0045] It should be noted that the resource response matrix M in this embodiment is essentially a performance deviation allocation matrix obtained by column normalization of signed sensitivity. It is used to allocate the deviation of each performance dimension to the resource dimension according to the relative influence of each resource on that performance dimension; it does not require the establishment of... The forward exact physical model of this form does not require inverting the sensitivity matrix. Therefore, Used to determine the direction and relative magnitude of resource adjustments in the current cycle, rather than guaranteeing that a single adjustment will completely eliminate performance deviations. The monitoring controller remeasures in the next cycle. and Based on this, δ and u are recalculated to form a small-step closed-loop iteration.

[0046] here, This represents a column vector of resource disturbances composed of the relative changes in various adjustable monitored resources. This represents a dimensionless performance change column vector corresponding to coverage and response latency; where For the first The percentage change in resource class relative to its configuration before the disturbance. At that time, its transposition and The product is multiplied to obtain a two-dimensional vector.

[0047] ;

[0048] Considering that single-resource sensitivity represents the local first-order response near the current operating point, to avoid unclear attribution of performance changes due to simultaneous changes in multiple resources, if configuration changes occur simultaneously for two or more types of resources during a normal resource adjustment cycle, the record for that cycle will not be directly used as a single-resource sensitivity sample. The monitoring controller can insert a single-resource small-disturbance calibration window every 10–50 monitoring cycles, or when performance deviations fail to converge for 3–5 consecutive cycles: keeping other resource configurations unchanged, only applying a 5%–10% relative change to the selected resource; after the configuration stabilizes, the performance change is collected and the corresponding sensitivity is updated. The upper limit of single-cycle resource adjustment is s. max This is used to keep normal adjustments within a locally approximate effective range; if the newly obtained sensitivity has the opposite sign to the median of the historical effective sensitivity of the resource-efficiency combination, the sensitivity of the combination is re-determined using the most recent effective perturbation record and is validated in subsequent cycles.

[0049] After forming an effectiveness deviation vector based on the target monitoring effectiveness and the measured monitoring effectiveness, the effectiveness deviation vector is multiplied by the resource response matrix to obtain the resource adjustment vector. Each component of the resource adjustment vector represents the adjustment ratio of the corresponding resource relative to the current configuration. After completing the single-cycle adjustment amplitude limit, the updated probe density, traffic mirroring range, feature calculation frequency, and other resource configurations, along with the corresponding effective period and the target monitoring effectiveness, are combined to form the network security monitoring strategy for the next monitoring cycle, which is then issued by the monitoring controller to the corresponding sensing node or processing node for execution.

[0050] To maintain consistency in the correspondence between "performance deviation vector - resource response matrix - resource adjustment vector," this implementation method uniformly adopts a positive value notation to represent the corresponding performance dimension that needs improvement. The coverage deviation component can be represented as... The response delay deviation component can be expressed as: and form When a component of δ is positive and the corresponding sensitivity is positive, the resource component obtained by matrix mapping tends to increase; when the corresponding sensitivity is negative, the resource component tends to decrease, in order to maintain the alignment of the performance deviation direction with the resource impact direction. The minimum valid positive value used for coverage calculation can be set according to the coverage statistical resolution; This is a preset value greater than 0, representing the single-cycle performance deviation limit. The resource response matrix M has the following dimensions: δ is a 2D column vector. Adjust the vector for the m-dimensional resource. For the p-th resource, we have Therefore, the aforementioned "tendency to increase or decrease" refers to the contribution item formed by a single effectiveness dimension. In this direction, when multiple performance dimensions exist simultaneously, the final result is determined by the sum of the contributions of each item. Contributions with opposite signs are allowed to cancel each other out.

[0051] For the Class resources, Indicates the first The individual contribution of each performance dimension to the adjustment of this resource: This represents the signed response weight of the resource to the corresponding performance dimension. This represents the dimensionless deviation component of the performance dimension, and its product is the dimensionless relative adjustment ratio of the corresponding resource. A positive product results in an increase in the contribution of the resource, while a negative product results in a decrease in the contribution of the resource. The final adjustment direction is determined by the algebraic sum of the coverage contribution and the latency contribution.

[0052] ;

[0053] Specifically, the initial resource adjustment amount without limit is: After applying a single-cycle adjustment upper limit constraint to u, the final resource adjustment vector v is obtained. When actually updating resource configuration, v is used instead of the unconstrained u. For resources with discrete configuration granularity, such as probe quantity and mirror port set, the adjustment is first performed according to... Once a continuous target value is obtained, the closest executable configuration is selected according to the minimum configuration granularity allowed for that type of resource. If the configuration does not actually change after quantization, the resource change corresponding to that period is recorded as 0 and is not recorded as a new valid disturbance.

[0054] Furthermore, when a certain type of resource is allowed to be configured to 0 or its current configuration value is lower than its minimum effective configuration resolution, it is directly adopted. The proportional update method may make it difficult for the resource to be activated from a 0 state. To address this, a minimum positive configuration step size can be set for the resource. and take the updated reference value. ,according to Calculate continuous target values; when Not less than For non-negative resource configurations, this formula has the same adjustment direction as the original proportional update. For integer quantities, discrete tiers, or aggregate resources, it is subsequently scaled to the executable configuration using the minimum allowed configuration granularity. This avoids the situation where the proportional update result is always 0 when the current resource value is 0.

[0055] Based on the above resource-performance adaptive configuration process, a complete monitoring process can be further formed by combining the following rule scheduling, time-series feature tracking, and rule evolution process:

[0056] S1: Establish a multi-source time-series monitoring rule base, which contains multiple types of network security monitoring rules. Each type of rule has several copy instances. Each type of rule is associated with a real-time activation weight, which is determined by the number of copies of that type of rule and the normalization function.

[0057] The calculation method for the real-time activation weight of each rule type is as follows:

[0058] ;

[0059] in, The intermediate relative score of the i-th rule obtained by the normalization function; The final real-time weight is enabled for the i-th type of rule; Let be the number of copies of the i-th rule. Take a positive integer; N(·) is the normalization function from copy number to relative score. Finally, to enable weights in real-time, the intermediate relative scores of various rules need to be probabilistically normalized to meet the requirements. To avoid mistaking relative scores as selection probabilities when using linear maximum value scaling.

[0060] The normalization function Including linear normalization functions, exponential normalization functions, and logarithmic normalization functions:

[0061] The expression for the linear normalization function is:

[0062] ;

[0063] in, For the first Copy number of class rules; For all The maximum number of copies in a rule class; this function is suitable for scenarios where the number of copies of rules is uniformly distributed, by directly mapping the number of copies to... The interval intuitively reflects the linear contribution of the copy size to the weight.

[0064] The expression for the exponential normalization function is:

[0065] ;

[0066] in, For the first Copy number of class rules; For the first Copy number of class rules; For adjustment coefficients, ; The total number of rule categories; λ is a natural constant; this function is suitable for scenarios that require strengthening the priority of high copy number rules, amplifying the relative score differences between rules with different copy numbers through exponential operations; when λ is a finite positive number and the subsequent execution probability is normalized, the sampling probability of each type of rule remains non-negative, and when the rule copy number is positive, it will not be directly set to zero due to exponential mapping. λ is used to control the degree of weight concentration of high copy number rules. The larger λ is, the more obvious the amplification effect of copy number differences on relative scores; in actual settings, it should be selected in conjunction with the range of copy number values, and λ should be kept as a finite positive number.

[0067] The expression for the logarithmic normalization function is:

[0068] ;

[0069] in, For the first Copy number of class rules; For the first Copy number of class rules; The total number of rule categories; It is the natural logarithm; this function is suitable for scenarios with a large range of copy numbers. It compresses the absolute difference in copy numbers through logarithmic transformation, prevents the rule weight monopoly of high copy number, and maintains the diversity of rule selection.

[0070] Specifically, to avoid directly using the relative score scaled to the maximum value as the final selection probability, this implementation divides the normalization process into two consecutive processes: "relative score calculation" and "probability normalization." Let the intermediate relative score of the i-th rule be... Then calculate the final real-time activation weight. Thus ensuring Taking rule A and rule B with copy numbers of 5 and 10 respectively as examples, when using linear maximum scaling, the intermediate relative score... , After further probability normalization, the weights are finally activated in real time. , Instead of directly using 0.5 and 1.0 as the final real-time activation weights, the real-time activation weights used in subsequent step S3 probability sampling all refer to the weights after the above probability normalization.

[0071] S2: Assign an initial weight to each type of rule, and adjust the weights of all rules synchronously based on the weight normalization principle to ensure that the sum of the weights of all rules is always 1 at any time; collect a baseline snapshot of the current network environment and generate a multi-dimensional monitoring instruction set as a reference target for subsequent strategy execution; the rule base and the reference target together constitute the resource pool and target benchmark for strategy generation.

[0072] The formula for weight normalization adjustment is as follows:

[0073] ;

[0074] in, For the first The current weight after normalization of the class rule; For the first Initial weights for class rules; For the first Initial weights for class rules; Total number of rule categories; denominator item This is the sum of the initial weights for all categories; this formula maps the initial weight vector to the probability simplex space, ensuring that the weight distribution satisfies the constraints. To maintain the probabilistic distribution characteristics of the selection and avoid policy bias caused by weight drift, the initial weights of all rules are non-negative to avoid zero denominators, and at least one type of rule has an initial weight greater than 0.

[0075] To avoid two independent final selection probabilities arising from "determining real-time activation weights based on copy number" in step S1 and "normalizing initial weights" in step S2, the initial weights in step S2 are only used for cold starts of the rule base. When the rule base is first established, the initial weights of each type of rule are normalized to obtain an initial selection distribution; when the copy number of each type of rule... Once determined, the final real-time activation weights for subsequent monitoring cycles will be uniformly set according to step S1. Calculation. After changing the copy number in step S5, the real-time activation weights of all rules are recalculated according to the same formula, instead of using the initial weights as another set of parallel final probabilities.

[0076] The baseline situation snapshot encompasses multiple dimensions, including network topology, active asset attributes, known vulnerability distribution, and external threat intelligence, forming a structured representation through feature abstraction and state encoding; the multi-dimensional monitoring instruction set includes:

[0077] The coverage directive requires that the monitoring range be sufficient for key nodes and links;

[0078] The accuracy command requires that the false alarm rate and the false negative rate be within acceptable thresholds.

[0079] The timeliness instruction requires that the time delay from data acquisition to alarm triggering meet the response requirements.

[0080] S3: Based on the real-time activation weights of various rules in the rule base, randomly select one type of rule as the dominant monitoring rule for this period, broadcast its operation instructions and parameters to all sensing nodes in the network, and guide each sensing node to carry out collaborative monitoring according to the rule logic.

[0081] Based on the real-time activation weight of each rule category in the rule base Probability sampling is conducted to determine the dominant monitoring rule category for this period. The process is formalized as follows:

[0082] ;

[0083] in, For the first The real-time activation weights of rule classes are determined. During the initial cold start, the initial selection distribution can be obtained by normalizing the initial weights in step S2. Once the copy number of each rule class has been determined, the real-time activation weights used for probability sampling in this cycle are uniformly determined based on the copy number and normalization formula in step S1. The initial weights in step S2 are no longer used as another set of parallel probabilities in the calculation. This mechanism ensures that high-weight rules have a higher probability of being selected in the monitoring task, while not completely excluding low-weight rules, thus balancing monitoring stability and exploratory nature.

[0084] S4: During the monitoring process, multi-dimensional performance indicators and time-series feature tracking data are continuously collected. The multi-dimensional performance indicators include coverage and response latency. Based on the baseline situation snapshot and the multi-dimensional monitoring instruction set, coverage adjustment factors and latency adjustment factors are calculated. The monitoring resource configuration vector direction and monitoring intensity scalar amplitude are mapped by the strategy generation controller. The time-series feature tracking data includes identifying network entities, constructing a state sequence across time slices, dividing functional areas, calculating feature deviation scores, comparing them with a standard health sample library, and marking potential risk points.

[0085] The formulas for calculating the coverage adjustment factor and the delay adjustment factor are as follows:

[0086] ;

[0087] ;

[0088] in, This is a coverage adjustment factor; The target coverage baseline value is set according to the coverage instruction; This represents the measured coverage for the current period; when hour, A value greater than 1 indicates insufficient coverage and the need to increase the allocation of relevant resources; where ε C A small positive number is set to prevent division by zero when the measured coverage is 0; its value is no greater than the minimum effective resolution of the coverage. (C) base ∈(0,1],C cov ∈[0,1].

[0089] This is a time delay adjustment factor; This is the measured average response delay for this period. The target response delay threshold is determined according to the timeliness instruction; when A value greater than 1 indicates a latency bottleneck in the current processing link, requiring optimization of the computation or transmission path. To ensure the ratio has a clear physical meaning, T... base The target response delay should be greater than 0, T. resp The measured response delay is non-negative.

[0090] The policy generation controller receives the coverage adjustment factor. With time delay adjustment factor Other dimensional adjustment factors are adjusted through a pre-defined multi-objective mapping function. Convert it into a monitoring resource allocation vector direction With monitoring intensity scalar amplitude Together, they constitute the execution vector for the next cycle's strategy adjustment:

[0091] In this embodiment, the multi-target mapping only enables two performance dimensions: coverage and response latency. Therefore, when no other performance dimensions are configured, the input to the policy generation controller only includes α. C and α T The resource response matrix dimension remains m×2. The aforementioned "other dimension adjustment factors" are optional extensions and are not included in the calculation of this embodiment. If an accuracy-equivalent performance dimension is added later, the target value, measured value, and dimensionless deviation definition of that dimension should be given first, and the corresponding column of the resource response matrix should be added simultaneously before participating in the matrix mapping, so as to avoid directly inputting undefined parameters into the current m×2 calculation process.

[0092] ;

[0093] in, For execution vector; To monitor the magnitude of the intensity scalar and control the overall level of resource input; To monitor the vector direction of resource allocation, express It is a configuration direction defined on the real number domain with m degrees of freedom. Each component points to a priority enhancement direction for different monitoring dimensions, including increasing the probe density of key nodes, expanding the traffic mirroring range, or increasing the feature calculation frequency. This execution vector dynamically guides resource reallocation and strategy reconfiguration based on performance deviation, so that the system approaches the instruction set requirements in terms of coverage and latency.

[0094] To ensure that the multi-objective mapping function can be directly reproduced, in one specific implementation, the coverage deviation ratio is set to... Delay deviation ratio Then construct a bounded deviation vector ,in , ; This means restricting x to Inside, To suppress single-cycle mutations, a value of 0.3 to 0.5 is preferred; in this embodiment, 0.5 is used. A positive value indicates that the corresponding indicator has not reached the target and the direction of resource compensation needs to be determined according to the response matrix; a negative value indicates that the corresponding indicator is better than the target and resource recovery is allowed according to the response matrix.

[0095] in, It is an interval-limited amplitude function; It is an input scalar that has not yet been limited. It is the lower limit of what is allowed. It is the allowed upper limit, and satisfies When calculating coverage deviation, When calculating the response delay deviation, Both are taken and This is to suppress sudden changes in performance deviations within a single monitoring cycle.

[0096] ;

[0097] Assuming the current adjustable resource dimension is m, including at least the key node probe density, traffic mirroring range, and feature calculation frequency, construct the resource response matrix. Matrix elements This represents the signed response weight of resource p to performance deviation q, with values ​​ranging from 1 to 2. For the same performance dimension, column normalization is performed based on the absolute value of sensitivity, so that the sum of the absolute values ​​of all elements in the column is 1. The performance deviation vector is denoted as δ, and the resource adjustment amount without single-cycle amplitude limitation is... .

[0098] The matrix M can be obtained based on historical operational data or small disturbances before deployment. For the effective disturbance records of the p-th type of resource, the relative resource change is first calculated. Then calculate the coverage improvement amount separately. And latency improvement ,Depend on Obtain the signed sensitivity and press Complete column normalization. If multiple valid records exist in the most recent 20-50 monitoring periods, normalize by taking the median sensitivity for the same resource-efficiency combination; if the sum of the absolute values ​​of a column's sensitivity is less than... If the previous valid matrix column is not used, then that column can be set to zero. This process preserves both the magnitude of the resource impact and the directional information regarding whether resource increases improve or worsen performance.

[0099] The specific forms of the resource allocation vector direction and monitoring intensity scalar magnitude obtained from u are as follows:

[0100] Let the Euclidean norm of the resource adjustment vector be... The resource allocation direction, single-cycle adjustment magnitude, and final execution vector are determined according to the following formulas:

[0101] ;

[0102] ;

[0103] ;

[0104] in, The zero vector is consistent with the dimension of the resource adjustment vector. This is the threshold for determining whether resource changes are negligible. The above segmentation definition avoids division by zero when the vector norm is zero and ensures that the magnitude of the execution vector does not exceed the single-cycle adjustment upper limit.

[0105] Where ε is a tiny positive number used to determine whether the resource adjustment amount is negligible, and can be taken as... ; The upper limit for single-cycle resource adjustment is preferably set between 0.05 and 0.30; in this embodiment, it is set to 0.20. When No more than From time to time ;Exceed The amplitude is adjusted by reducing it only in the original direction. The p-th component of vector v is then executed. Used to update the corresponding resource configuration: .in, and These are the configuration values ​​for the p-th resource in the current period t and the next period t+1, respectively. , These are the lower and upper limits of the allowed configuration for this type of resource, respectively, to meet the requirements. ; Let p be the p-th component of the execution vector v, representing the adjustment ratio of the resource relative to the current configuration. Since... Not greater than 0.30, therefore it will not cause [the problem] within a single cycle. It becomes a non-positive value.

[0106] For example, when Furthermore, when the three resource dimensions are probe density, traffic mirroring range, and feature calculation frequency, a +8% single-resource perturbation is applied to each of the three resource types within the three calibration windows of network load matching. Let the target coverage be... Target response delay The coverage increases corresponding to the three disturbances are 0.030, 0.020, and 0.005, respectively, and the response latency decreases are 5ms, 2ms, and 14ms, respectively. After calculating and normalizing the columns based on the relative resource changes and normalized performance improvements, the example resource response matrix can be obtained. If a certain sensitivity is measured to be negative, the corresponding matrix elements retain the negative sign, so that subsequent resource adjustments can provide a direction for reducing resources rather than simply increasing them.

[0107] The processing of time-series feature tracking data includes:

[0108] Network entities are identified using distributed probes, each entity is assigned a unique time-series identifier, and a state sequence across time slices is established. Among them, superscript Indicates entity identifier, subscript Indicates the time slice number. Representing entities The corresponding number of recorded time slices; The total number of feature dimensions. This is the feature dimension number. Representing entities In time slice The The original feature observations are obtained by uniformly encoding the traffic statistics, connection modes, protocol distributions, or behavioral entropies collected by distributed probes.

[0109] ;

[0110] For continuous features The values ​​were standardized according to the statistics of a standard health sample database:

[0111] ;

[0112] ;

[0113] in, This represents a standard health sample library. The number of healthy samples defined by the same characteristic. For the healthy sample serial number, For the first The first healthy sample 3D feature observations, and These are the sample mean and sample standard deviation of this health characteristic, respectively; This serves as a zero-prevention lower limit for the measurement resolution of this dimension. For discrete features that cannot be directly calculated as real numbers, they are first converted into numerical values ​​using a preset category code or frequency code. The standardized feature vector is denoted as... .

[0114] Entities are clustered based on topological proximity and functional similarity to divide them into several functional regions;

[0115] Within each functional region, calculate the characteristic deviation score of the entity state sequence relative to the historical health baseline:

[0116] ;

[0117] ;

[0118] in, For entities In time slice Feature deviation score; This is the normalized feature vector of the entity in that time slice; This is the mean vector of health features of the health samples corresponding to the entity or the same functional area after undergoing the same standardized processing. The first of the health mean vectors Dimensional components; Represents the Euclidean norm. Superscript Always identify the corresponding entity, subscript and The time slice and feature dimension are identified separately. The current vector and the healthy mean vector are calculated using the same feature order and the same standardized parameters to avoid distortion caused by inconsistent dimensions or feature arrangement.

[0119] When the deviation score Exceeding the preset threshold At that time, the entity is marked as a potential risk point, triggering a fine-grained forensics and correlation analysis process.

[0120] The deviation threshold The values ​​are not arbitrarily given, but determined by a standard healthy sample database. Specifically, the deviation is calculated for each time slice in the healthy sample database using the same feature preprocessing method, forming a set of healthy deviation values. The 95th to 99.5th percentiles were used as candidate thresholds; in network regions requiring lower false alarm rates, the 99th percentile was preferred. When the healthy sample size is insufficient to stably estimate quantiles, the following method can be used: As the initial value, it switches to quantile estimation after accumulating at least 500 time slices of healthy samples. All continuous features involved in the Euclidean distance calculation are standardized using the mean and standard deviation of the healthy samples before calculation, thereby avoiding the direct dominance of deviation due to differences in dimensions. Represents the 99th percentile of the sample set; and Representing the sets of health deviations The mean and standard deviation of the sample, where h represents the time slice number of the healthy sample.

[0121] S5: Construct a comprehensive performance score based on coverage achievement and latency compliance rate, and set a risk judgment threshold that is dynamically adjusted according to recent false positive and false negative rates; if the comprehensive performance score is not lower than the risk judgment threshold, and the cumulative execution count of the dominant monitoring rule reaches a stable verification value, then the rule is determined to be reliable, its copy count is increased and the copy count and weight of other rules are adjusted simultaneously, the cumulative execution count of the rule is cleared to zero, and it is recorded as an information configuration template; if the comprehensive performance score is lower than the risk judgment threshold, then the copy count of the rule is reduced and its weight is lowered, the baseline situation snapshot and multi-dimensional monitoring instruction set are corrected based on the deviation of each indicator, and the mapping parameters of the strategy generation controller are adjusted.

[0122] The overall performance score is calculated as follows:

[0123] ;

[0124] in, To score overall performance; The weighting coefficient for coverage achievement in the overall evaluation; This is the weighting coefficient of latency compliance rate in the overall evaluation, and it satisfies... ; To achieve coverage; For latency compliance rate;

[0125] The coverage achievement Defined as:

[0126] ;

[0127] in, This represents the measured coverage for the current period. C represents the target coverage baseline value set according to the coverage directive; where C base C should be greater than 0 and not greater than 1.cov Take the measured proportion within the range of [0,1].

[0128] The latency compliance rate Defined as:

[0129] ;

[0130] in, This is the measured average response delay for this period. Let be the target latency threshold, and ; This is the minimum significant positive value for time delay measurement, used to handle the time resolution issues. If the record is 0, the minimum timing resolution of the monitoring system can be set.

[0131] The dynamic adjustment formula for the risk assessment threshold is:

[0132] ;

[0133] in, The risk assessment threshold is dynamically adjusted. This is the initial risk assessment threshold; This is the gain coefficient of false alarm rate and false negative rate on the threshold; and These represent the proportion of false positives and the proportion of false negatives within the statistical period, respectively, both taken as... ; Used to limit the calculation results to Within the scoring range. This formula raises the rule reinforcement threshold when recent false positives or false negatives increase, while avoiding thresholds exceeding the effective range of the overall performance score.

[0134] In risk threshold calculation, Specifically refers to candidate risk thresholds for which the range limit has not yet been implemented. Lower limit This represents the minimum and maximum allowed values ​​for the scoring range. This indicates the maximum allowed value within the scoring range. Candidate values ​​less than... Time output ,lie in Time remains unchanged, greater than Time output ;in and .

[0135] ;

[0136] Furthermore, and The false alarm rate is calculated using samples with confirmation labels within the same statistical window. It can be defined as follows: The false negative rate can be defined as ;in, , , and These represent the number of false alarms, true negatives, missed alarms, and true samples, respectively. Confirmation labels can come from the results of security operations personnel's review, the final labels of closed-loop events, or known true values ​​in the simulation / replay environment. If there are no corresponding positive or negative samples within the statistical window that can form the denominator of a certain ratio, the ratio will not be updated in that window and will use the most recent valid value; in the case of a cold start and no historical valid values, the corresponding ratio will be temporarily set to 0.

[0137] The decision logic checks the following two conditions in sequence:

[0138] Condition 1: The aforementioned comprehensive performance score Not lower than the dynamic risk assessment threshold ;

[0139] Condition 2: Dominant Monitoring Rules Cumulative execution count Reaching the preset stable verification value ;

[0140] The rule is deemed reliable and positive reinforcement is performed only if both conditions are met: the number of copies c of the dominant monitoring rule k is increased. k Increase Δc + Simultaneously, based on the real-time weight normalization formula in step S1, the weights of other rules are adjusted synchronously to maintain a total weight of 1, and the cumulative execution count N of this rule is calculated. k The current configuration is cleared and recorded as an information configuration template; the current configuration includes rule logic, parameter set, weight, copy number and associated performance record.

[0141] For step S5, "synchronously adjust the copy number and weight of other rules," the specific handling depends on whether a total copy budget is set. When the rule base does not limit the total copy number, positive reinforcement only increases the copy number of the dominant rule k, while the copy number of other rules remains unchanged, and then... Recalculate the real-time enable weights for all rules; when a fixed total copy budget is preset. At that time, the dominant rule increases While copying the code, the same number of copies are reduced from other rules in ascending order of the most recent valid evaluations, with each rule not falling below a certain threshold. If the number of releasable copies is insufficient, the actual increase in the dominant rule will be limited to the number of releasable copies. Therefore, the synchronous adjustment of copy counts for other rules only occurs in scenarios with a fixed total copy budget, preventing arbitrary changes to the copy counts of other rules when no budget constraints are given.

[0142] in, The minimum number of copies that must be retained for each type of monitoring rule, taken as a positive integer; in this embodiment, it is taken as... This is used to ensure that at least one instance of any rule is retained for subsequent sampling, verification, and recovery, preventing low-weight rules from being permanently deleted. The maximum number of copies allowed for a single rule type. This represents the total number of rule categories. When using a fixed total copy budget, budget feasibility and the copy boundaries for each rule category must be satisfied first:

[0143] ;

[0144] Except for the dominant rules The maximum number of copies that can be released under other rules and the actual number of copies added by the dominant rule in this instance are as follows:

[0145] ;

[0146] ;

[0147] in, This refers to the copy budget that can be released without exceeding the minimum copy number constraint. The actual positive reinforcement increment is simultaneously subject to the planned increment, the upper limit of the dominant rule, and the release budget; the same number of copies as this actual increment are deducted from other rules in ascending order of the most recent effective evaluation.

[0148] When the overall performance score Below the risk assessment threshold When this occurs, a negative adjustment operation is performed, including:

[0149] The number of copies c of the dominant monitoring rule k k Reduce Δc − And accordingly lower its real-time activation weight in the rule base. k This is to reduce the probability that it will be selected as the dominant rule in subsequent cycles;

[0150] The baseline situation snapshot and multi-dimensional monitoring instruction set are corrected based on the deviations of various performance and accuracy indicators, including incremental updates to the threat intelligence database and adjustments to coverage instructions. Time-limited instructions Recalibrate the target;

[0151] Adjust the mapping parameters of the strategy generation controller, including the weighting coefficients of the coverage adjustment factor and the delay adjustment factor, as well as the sensitivity threshold for vector direction decision.

[0152] The key engineering parameters in the above steps can be determined as follows. (In the comprehensive performance evaluation) and satisfy Preferably, values ​​are selected within the range of 0.2 to 0.8; for scenarios with higher requirements for coverage integrity, the values ​​are increased. Improves performance for scenarios with higher real-time requirements This embodiment takes , .

[0153] Initial value of risk assessment threshold The optimal value can be determined by the comprehensive performance score distribution of historically reliable rules, preferably at the 10%–25% quantile of this distribution, and in a normalized scoring scenario, it can be 0.75–0.85; false negative / false negative gain coefficient. The preferred value is 0.05 to 0.30; in this embodiment, 0.20 is used. To ensure that the threshold always remains within the valid scoring range, the specific implementation uses... . A grid search can be performed by replaying the most recent week or at least 1,000 labeled alarm samples, and the candidate value with the lowest sum of false alarm rate and false negative rate and no frequent oscillation of threshold can be selected.

[0154] Stable verification value Determined based on the allowable statistical estimation error. Whether a single complete execution of the dominant rule reaches the comprehensive effectiveness threshold is treated as a Bernoulli random variable, at a confidence level. and allowable absolute estimation error The minimum number of complete samples is estimated using the following formula and rounded up:

[0155] ;

[0156] in, This represents the floor function; For a standard normal distribution with cumulative probability quantiles at the point, the whole for The subscript, and The superscript for the square of that quantile; The significance level; To account for the allowable absolute estimation error, its subscript Indicates a statistical estimate, not superscripted on the entity identifier. or natural constant Confusion; The prior success probability of a single complete execution reaching the overall performance threshold is given by the index. A value of zero represents the initial prior value, which can be obtained from the ratio of the number of successful executions to the total number of complete executions in the historical replay samples, and satisfies the following conditions: When historical data is missing, retrieve... In order to obtain a conservative sample size.

[0157] This embodiment takes , and ,but The calculation process is as follows:

[0158] ;

[0159] In engineering, it can be preferred When the minimum sample size required for statistical error exceeds this range, the calculated minimum sample size shall prevail. The cumulative execution count only includes monitoring periods in which the dominant rule was actually selected and completed full performance sampling.

[0160] To ensure that historical execution samples corresponding to stable verification values ​​actually participate in reliability assessment, in a preferred implementation, the monitoring controller stores the most recent dominant monitoring rule. The overall performance score corresponding to each complete execution When the cumulative number of complete executions reaches... At that time, the average comprehensive performance score within the stable verification window is recorded as follows: and with Not lower than the current risk assessment threshold This serves as a positive reinforcement performance condition, thereby avoiding the immediate reinforcement of rules simply because a threshold is accidentally reached in a single cycle. The exemplary simulations described below only show the current cycle score at the trigger decision moment; in actual deployment, the scores of the complete execution of the preceding sequence are accumulated and saved according to the stability verification window described above.

[0161] To standardize the judgment criteria in step S5, when using the aforementioned stable verification window, when the cumulative number of complete executions reaches... Subsequently, the "comprehensive effectiveness score" used for positive reinforcement determination in step S5 and condition 1 uniformly refers to the average value of the stable verification window. single cycle This is only used as a sample to form the average; the cumulative number of times has not reached... Previously, even in a single cycle Furthermore, positive reinforcement by increasing the copy number is not performed. If the rule parameters of the dominant rule or the resource configuration bound to it undergoes substantial changes due to negative adjustments during the window accumulation period, the current stable verification window of that rule is cleared and accumulation is restarted from the adjusted configuration to avoid mixing scores from different configuration states for the same reliability judgment.

[0162] The changes in copy number for positive reinforcement and negative adjustment are denoted as follows: and All values ​​are positive integers. To avoid sudden weight changes caused by a single adjustment, the preferred range is 1 to 3, and a lower limit is set for the number of copies of a single rule. Upper limit The adjustment amount can be determined based on the difference between the comprehensive performance score and the risk assessment threshold: when When the difference is 1, it is taken as 1. Use 2 when the difference is not less than 0.10, and use 3 when the difference is not less than 0.10; positive reinforcement execution. negative adjustment execution Then, the real-time activation weights of all rules are recalculated according to the real-time activation weight formula in step S1.

[0163] To standardize the calculation of the difference between positive reinforcement and negative adjustment, an evaluation metric is defined to determine the change in copy number. When positive reinforcement is performed and hour, Take the average value of the stable verification window When a negative adjustment is performed, Take the current period that triggered this negative adjustment. Therefore, the aforementioned In determining or Time uniformly according to The calculation is then performed, and the change in copy number is determined based on two difference thresholds of 0.05 and 0.10.

[0164] To further illustrate the above parameters and calculation process, a complete set of exemplary simulation execution examples is provided. These examples are intended to demonstrate that each step can be reproduced by those skilled in the art and do not limit the network scale and parameters in actual deployment. The simulated network contains 100 network entities, of which 12 are key nodes; the monitoring period is 60 seconds; the rule base contains three categories of rules: Rule A, Rule B, and Rule C, with initial copy numbers of 5, 10, and 5 respectively; the health sample library contains 2000 time slices without known attacks, and the traffic statistics, connection mode numerical characteristics, protocol distribution characteristics, and behavioral entropy are standardized.

[0165] When using linear maximum scaling, the median relative scores of the three types of rules are 0.5, 1.0, and 0.5, respectively. After calculation using the probability normalization formula in step S1, the initial real-time activation weights are 0.25, 0.50, and 0.25, respectively. Let the target coverage be... Target response delay , , , , , , , Based on the 99th percentile of the health deviation set, the following was obtained: .

[0166] In a certain period of sampling, rule A was selected as the dominant monitoring rule, and the measured coverage was... Average response time Therefore, coverage adjustment factor Delay adjustment factor ,get The method used was the one calibrated from the aforementioned disturbance records. Calculations yielded , less than ,therefore Based on this, probe density, flow mirroring range, and feature calculation frequency are increased by approximately 10.8%, 5.9%, and 14.3% respectively relative to the current configuration. The adjustment direction in this example is derived from the corresponding sensitivity sign, rather than being pre-fixed as an increase or decrease.

[0167] In the next monitoring cycle, if the coverage of the exemplary simulation record is 0.91 and the average response latency is 185ms, then the coverage achievement rate is... Latency compliance rate Overall performance score If the false alarm rate for the most recent statistical period underreporting rate ,but Assuming the average overall performance score of Rule A in the previous 29 complete executions was 0.86, then including this execution... Subsequently, the average overall performance score of the most recent 30 stable validation windows. When rule A has accumulated the number of times it has completed full performance sampling. achieve hour, Therefore, the positive reinforcement condition is met, and its copy number is increased from 5 to 6. At this point, the intermediate relative scores of the linear maximum scaling of the three rules become 0.6, 1.0, and 0.5, and after probability normalization, the real-time activation weights are approximately 0.2857, 0.4762, and 0.2381, with a sum of 1. This indicates the cumulative number of times rule A has completed full performance sampling, in the current period. It is used only as the 30th sample value in the stability verification window.

[0168] For time-series anomaly tracking, an entity selected from the same functional region has deviations from the healthy mean vector over six consecutive time slices of 1.15, 1.42, 1.77, 2.18, 2.69, and 3.24, respectively. Since the first five time slices did not exceed... The system retains the entity's state sequence across time slices without immediately labeling it; when the deviation reaches 3.24 in the 6th time slice, the entity is labeled as a potential risk point and fine-grained forensics is triggered. This process ensures that the trajectory of gradual deviation from the healthy baseline is continuously preserved and generates a clear alarm when a threshold determined by statistical analysis of healthy samples is reached.

[0169] In the same exemplary simulation environment, a traffic load increase disturbance was further applied for 20 consecutive cycles. The average coverage for the first 5 cycles was 0.82, and the average response latency was 238 ms. After enabling the aforementioned multi-target mapping and resource adjustment, the average coverage for the 16th to 20th disturbance cycles was 0.90, and the average response latency was 198 ms, both returning to near the set target. Timing tracking was performed on 8 entities preset to asymptotically deviate; the deviation of 7 of these entities exceeded θ within the observation window. D One entity was not marked because its deviation remained below the threshold at the end of the observation window; of the remaining 92 healthy entities, three were marked because their short-term fluctuations exceeded the threshold. The simulation data above illustrates that, given specific parameters, sample library, and perturbation conditions, this method can form a computable and reproducible closed loop of "rule sampling - performance measurement - resource mapping - threshold determination - rule evolution," and verifies the adaptive recovery process after time-series deviation marking and load perturbation.

[0170] The aforementioned network security monitoring method, by constructing a multi-source time-series monitoring rule base and a dynamic weighting mechanism, achieves adaptive and precise monitoring of complex network environments, resulting in significant technical effects.

[0171] By establishing a rule base that accommodates multiple types of rules and their copy instances, and combining it with real-time activation weights (determined by the number of copies and a normalization function), along with baseline situation snapshots and multi-dimensional monitoring instruction sets, a resource pool and target benchmark for strategy generation are formed, providing a structured decision-making basis for monitoring tasks. The dynamic adjustment mechanism of weights (initial weight normalization, increasing or decreasing the number of copies and adjusting the weights synchronously during execution based on performance scores) allows the rule selection probability to dynamically match the needs of the network environment. This avoids the limitations of a single rule and provides a unified coordinate for time-series tracking and performance evaluation through weight distribution, improving the flexibility and interpretability of the monitoring strategy.

[0172] Based on real-time weights, a dominant rule is randomly selected and operational instructions are broadcast to guide collaborative monitoring across the entire network of sensing nodes. Combining multi-dimensional performance indicators (coverage, response latency) and time-series feature tracking data (network entity state sequences, feature deviation analysis), a strategy generation controller maps the resource allocation vector direction and intensity scalar amplitude, achieving dynamic focusing and intensity adjustment of monitoring dimensions. This closed-loop process of "weight-driven selection - multi-source data acquisition - dynamic strategy adjustment" effectively improves the breadth of monitoring coverage and response timeliness. Simultaneously, by comparing feature deviation with a standard healthy sample library to mark potential risk points, the depth and accuracy of anomaly identification are enhanced.

[0173] A comprehensive performance score based on coverage achievement and latency compliance rate, combined with a risk assessment threshold dynamically adjusted for recent false positives / false negatives, and a stable verification mechanism based on the cumulative execution count of dominant rules, forms a closed loop for rule selection and optimization. For rules that meet performance targets and execute stably, the copy number is increased and the weights are re-normalized, and their configuration is recorded as an information configuration template. For rules with insufficient performance, the copy number is reduced, the subsequent sampling probability is lowered, the baseline and instruction set are corrected, and the controller mapping parameters are adjusted for re-verification in the next cycle. Based on the above exemplary simulation records, after load increases and disturbances, coverage and response latency can return to near the set target during continuous adjustment. At the same time, the cross-time slice deviation sequence can continuously record entities that gradually deviate from the healthy baseline and trigger risk marking after exceeding the statistical threshold. This demonstrates that the closed-loop adjustment and time-series tracking steps described in this method are executable.

[0174] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A network security monitoring method, characterized in that, The method includes: Acquire the target monitoring effectiveness, measured monitoring effectiveness, and resource disturbance records of various adjustable monitoring resources for the current monitoring period; An effectiveness deviation vector is generated based on the target monitoring effectiveness and the measured monitoring effectiveness. The sensitivity is determined based on the resource change and corresponding effectiveness change of various adjustable monitoring resources in the resource disturbance record. A resource response matrix is ​​constructed based on the sensitivity. The efficiency deviation vector is mapped to a resource adjustment vector using the resource response matrix, wherein the sensitivity is the degree of influence of the corresponding resource change on the corresponding monitoring efficiency dimension; After updating the configuration of various adjustable monitoring resources based on the resource adjustment vector, the network security monitoring strategy for the next monitoring cycle is output.

2. The network security monitoring method according to claim 1, characterized in that, Sensitivity is determined based on the resource changes and corresponding performance changes of various adjustable monitoring resources in the resource disturbance records, including: Keep all resource allocations unchanged except for the target adjustable monitoring resources; Apply a preset range of resource changes to the target adjustable monitoring resource; Obtain the corresponding changes in monitoring effectiveness; The sensitivity is determined based on the ratio of the change in resource quantity to the change in monitoring effectiveness.

3. The network security monitoring method according to claim 2, characterized in that, The resource response matrix update includes: when historical calibration data is missing, a preset initial resource response matrix is ​​used, and during operation, the sensitivity between each resource and each monitoring performance dimension is re-determined based on the resource change and corresponding performance change within the most recent preset number of monitoring periods, and the resource response matrix is ​​updated.

4. The network security monitoring method according to claim 3, characterized in that, When constructing the resource response matrix, the sensitivity of each type of adjustable monitoring resource is normalized according to the same monitoring effectiveness dimension to obtain the response weight of each resource to the monitoring effectiveness dimension, and the resource response matrix is ​​formed by each response weight.

5. A network security monitoring method according to claim 4, characterized in that, A performance deviation vector is generated based on the target monitoring performance and the measured monitoring performance, including: The corresponding performance deviations are determined based on the target coverage and the measured coverage, and the measured response delay and the target response delay, respectively, and each performance deviation is limited to a preset deviation range.

6. A network security monitoring method according to claim 5, characterized in that, The performance deviation vector is input into the resource response matrix to obtain the initial adjustment amount for each resource dimension. The resource allocation direction and adjustment magnitude are determined based on the initial adjustment amount, and the magnitude is limited when the adjustment magnitude exceeds the upper limit of single-cycle resource adjustment.

7. A network security monitoring method according to claim 6, characterized in that, The configuration of various adjustable monitoring resources is updated based on the resource adjustment vector, including: The current resource configuration is updated proportionally according to the corresponding component of the resource adjustment vector, and the updated resource configuration is restricted to between the corresponding lower and upper limits.

8. A network security monitoring method according to claim 7, characterized in that, The various adjustable monitoring resources include at least key node probe density, flow mirroring range, and feature calculation frequency, and each component of the resource adjustment vector corresponds to the configuration adjustment amount of an adjustable monitoring resource.

9. A network security monitoring method according to claim 2, characterized in that, The resource disturbance record is obtained from historical operating data or resource disturbance calibration before going online. When performing the resource disturbance calibration, a preset ratio change is applied to a single type of adjustable monitoring resource, and the corresponding change in coverage or response delay is recorded.

10. A network security monitoring method according to any one of claims 1 to 9, characterized in that, The target monitoring effectiveness is determined by a multi-dimensional monitoring instruction set, and the measured monitoring effectiveness is determined by the effectiveness indicators collected in the current monitoring cycle. The multi-dimensional monitoring instruction set includes at least coverage instructions and timeliness instructions.

Images